Technical Note: How to limit the SSL and TLS versions of connections initiated by Forticlient

[athirat]

Description

This article describes how to control the SSL and TLS versions used by the FortiClient when connecting to SSL VPN.

Scope

FortiClient - All versions.

Solution

FortiClient uses the Internet Explorer SSL and TLS settings to initiate the SSL connection.

The versions used can be disabled and enabled by navigating to the following option on Internet Explorer:

Internet options > Advanced > Security

The options are shown in the following screenshot:

Configuration CLI

Using the FortiGate CLI the same options can be selected as follows:

#config vpn ssl settings
    set sslv3 disable
    set tlsv1-0 disable
    set tlsv1-1 enable
    set tlsv1-2 enable
end

Verification of Configuration and troubleshooting

If there is a version mismatch, the connection would be seen to be terminating with no definite error in the SSL VPN debugs.

Packet captures would show the versions that are incoming.